A USB dongle for one-time passwords

Loaded and Secured

OpenKubus is now ready, but it doesn't know your secrets. The stick-write tool in firmware/create-stick loads the three pieces of information into the EEPROM. A tool for preparing the stick does not exist as of this writing, so some manual work is now required: The -p option expects 48 characters – 32 bytes of AES key, a 14-digit data block, and two octets of the first serial numbers, without any separators.

The tool uses USB to transfer the command-line arguments to the stick without converting them. If you want to transfer binaries, you need to modify the source code. The -l option tells the firmware not to accept any more initial passwords. Of course, you could use the programmer to harden the stick, but this means that it will not accept firmware updates either.

PAM's Wedding

Most Linux distributions use PAM to authenticate users. This means that you can teach programs like login or sshd new authentication methods. OpenKubus includes its own module in the software/PAM/ directory that requires the PAM developer files from libpam0gdev. A call to make install copies it to the /lib/security/ directory and modifies the privileges. After completing the installation, and working as root, configure the modules in /etc/pam.conf or in the /etc/pam.d/ directory. Adding

auth sufficient pam_openkubus.so

to auth-common tells PAM to accept the stick [6] as an alternative in the future.

Verifying Passwords

To verify the authenticity of a password, the PAM module needs to know the stick's secrets. To allow this to happen, the administrator will store a line matching the user password serial_number format in /etc/openkubus-passwd. PAM compares the data with the input from the stick. Make sure the file is only readable by the root user.

If you want to check input from OpenKubus in your own applications without resorting to PAM, the lean OpenKubus library is a useful option that the project offers for many programming languages. The library itself is written in C, but the SWIG wrapper gives Python, Ruby, Java, Perl, or PHP access to its functionality [7]. Right now, the API only includes the following function:

This function expects the one-time password to check as the first argument and the AES key as the second. The last two arguments are an optional serial number offset (which defaults to 0) and the serial number itself. If successful, the function returns the serial number; if not, it returns a negative value.

The library only checks the password; it does not access a file. Developers who use OpenKubus need to manage the current serial number, the initial password, and the offset themselves. The sample network server in software/server/, which compares one-time passwords with a list, gives you an idea of how to manage these parameters.

Klaus Knopper is the creator of Knoppix and co-founder of the LinuxTag expo. He currently works as a teacher, programmer, and consultant. If you have a configuration problem, or if you just want to learn more about how Linux works, send your questions to: klaus@linux-magazine.com